apache
AVRO-4192: [JAVA] Update Jetty to version 12.1.4
What is the purpose of the change
This pull request updates Jetty from 9.4.x to 12.1.4, addressing AVRO-4192.
The reason for this update is because Jetty 9, 10 and 11 have all reached End of Life.
Verifying this change
This change is already covered by existing tests, such as TestProtocolHttps and TestStatsPluginAndServlet.
- Manually verified the changes by running the automated testing using mvn clean test and by building the project using mvn clean install.
Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
What is the minimum required version of Java for Jetty 12 ?
Its META-INF/MANOFEST.MF file says Build-Jdk-Spec: 22.
javap reports major version: 61, i.e. JDK 17.
Avro currently requires JDK 11+. The CI workflow is supposed to test with JDK 11, JDK 17 and JDK 21. I wonder how the JDK 11 build passes ?!
What is the minimum required version of Java for Jetty 12 ? Its META-INF/MANOFEST.MF file says
Build-Jdk-Spec: 22.javapreportsmajor version: 61, i.e. JDK 17.Avro currently requires JDK 11+. The CI workflow is supposed to test with JDK 11, JDK 17 and JDK 21. I wonder how the JDK 11 build passes ?!
According to the jetty documentation Jetty 12 needs Java 17. (ref: https://github.com/jetty/jetty.project/issues/10485 | https://jetty.org/docs/jetty/12.1/index.html, etc).
I did make one change relating to the java version in the top level pom file configuration under enforceBytecodeVersion maxJdkVersion to 17, as the build failed without this change (message was something like EnforceBytecodeVersion failed, found bad dependency). Perhaps this is the only place that was restricting the java version to ensure compatibility with Java 11?
If avro still requires JDK 11, perhaps it is not possible to update the jetty version at this time, even though jetty 9-to-11 are all end of life now? (particularly concerning in relation to any current and future CVEs relating to no-longer-supported dependencies)
If avro still requires JDK 11, perhaps it is not possible to update the jetty version at this time, even though jetty 9-to-11 are all end of life now? (particularly concerning in relation to any current and future CVEs relating to no-longer-supported dependencies)
I think it is a good idea to require JDK 17 for Avro 1.13 (main branch) but this should be discussed at [email protected] first.
If avro still requires JDK 11, perhaps it is not possible to update the jetty version at this time, even though jetty 9-to-11 are all end of life now? (particularly concerning in relation to any current and future CVEs relating to no-longer-supported dependencies)
I think it is a good idea to require JDK 17 for Avro 1.13 (
mainbranch) but this should be discussed at [email protected] first.
To keep this thread updated, I created a [Discuss] thread (https://lists.apache.org/thread/fyxtndbxnxh8qcy83plzrctk88wl5srj) and a [Vote] thread (https://lists.apache.org/thread/gl0m4yx6m7w50k38fywggc862cxn330h) in the apache avro dev mailing list. Could you advise on how to properly close the vote in this mailing list? I believe it would be done with a [Result] mail, but am unsure of the numbers required for vote to pass with consensus/majority.
Hello @andrewlamb-est -- just to confirm, I'm so glad that you're taking this work on. It's important!
Please, it would be helpful if you would do a [RESULT] thread! I'm focusing on doing minor releases (1.11.5 and 1.12.2) and bumping to Java 17 would definitely be a major release event, so I wouldn't expect much action on it until next year!
Hello @andrewlamb-est -- just to confirm, I'm so glad that you're taking this work on. It's important!
Please, it would be helpful if you would do a
[RESULT]thread! I'm focusing on doing minor releases (1.11.5 and 1.12.2) and bumping to Java 17 would definitely be a major release event, so I wouldn't expect much action on it until next year!
Hi @RyanSkraba, I would be happy to create a [RESULT] thread. As you've probably seen, the vote currently has 1 binding +1, and 4 non-binding +1s. In this instance, I was uncertain if the vote could be declared to pass without 3 binding +1 votes. Do you have any thoughts on this? @martin-g, adding you into this conversation as you were the 1 binding +1 on the vote, any comments?
Everyone who voted is a PMC member, so there are actually 4 binding +1s.
Sorry, I did not realize that, I would have put up a [RESULT] thread sooner. Thanks, Martin. I should have checked the PMC list (I'll make a mental note to do that in the future!) I will create a [RESULT] thread shortly.